Cookie policy — Marto.AI

The French version prevails. This English text is provided for convenience only. In the event of any discrepancy, the French version (version française) is the authoritative one (Terms, art. 16).

Marto.AI uses strictly necessary cookies only. No advertising cookie, no audience-measurement cookie, no cross-site tracker, and no consent management platform (CMP).

That is why no banner is shown to you: every cookie listed below falls within the exemption of article 82 of the French Data Protection Act, either because it is strictly necessary to provide the service, or because it delivers a feature you expressly asked for. Consent is not requested because there is nothing to consent to — not because it was presumed.

1. Complete inventory

Cookie	Set by	Purpose	Lifetime
sb-<project-reference>-auth-token (and its .0, .1, … fragments)	The Supabase authentication library (@supabase/ssr)	Keeping your session open between pages. Without it you would be signed out on every navigation.	For the duration of the session, renewed while you stay signed in; deleted on sign-out
marto_active_org_id	Marto.AI	Remembering which organization you are working in when you belong to several firms.	1 year
NEXT_LOCALE	The next-intl internationalisation library	Remembering the language you selected.	1 year

marto_active_org_id is set with the httpOnly, SameSite=Lax and — in production — Secure attributes: it cannot be read by JavaScript and is not sent with requests originating from other sites.

There is no other cookie. That statement is not an intention: it is verified automatically on every run of the test suite, on the landing page and on an authenticated page. Any cookie set outside this list fails the suite and blocks release.

2. Performance and audience measurement, without a cookie

The service uses two measurement tools provided by our host Vercel. Neither sets any cookie, neither assigns an individual identifier, and neither follows you from one site to another. They are nonetheless requests to a third party, and we prefer to say so.

• Vercel Speed Insights measures page loading times. It sends aggregated technical measurements (render time, visual stability) to /_vercel/speed-insights/vitals.
• Vercel Web Analytics counts page views, so that we know which pages are consulted and which are not. It sends the page consulted and the referrer to /_vercel/insights.

Page addresses are redacted in your browser, before anything is sent. This deserves spelling out, because it is what separates acceptable audience measurement from a leak:

• record identifiers contained in the address are replaced with [id] — /en/clients/8a7b… becomes /en/clients/[id], so nothing transmitted designates a particular file, lot or person;
• search parameters are removed, with the sole exception of campaign parameters (utm_*, ref). This is what guarantees that a name typed into the client search — which appears in the page address — is never transmitted. Any new parameter is removed by default.

This redaction is verified automatically by the test suite, on the same footing as the cookie inventory above.

No audience-measurement tool setting a cookie is in place. Should one ever be, a consent collection mechanism would be put in place before it is enabled, and this policy would be published as a new version.

3. Your browser remains in control

You may block or delete cookies at any time from your browser settings. We should however warn you of the one real effect: blocking the authentication cookie makes the service unusable, since you will no longer be able to stay signed in. Blocking the other two only degrades convenience — the active organization and the language will have to be selected again.

As no tracking cookie is set, there is nothing to refuse: advertising opt-out mechanisms (banners, exclusion lists) are moot here.

4. Processing of your data

The cookies above serve only the purposes described. The processing of personal data as a whole is described by the Privacy policy, in particular its section 9.

5. Contact

Any question about cookies may be sent through the support form (https://www.marto.ai/en/support), open to signed-in users, or by post to LCB LA COMPAGNIE BASQUE, 15 rue de la Présentation, 75011 Paris, France.